Attacks/Breaches
4/7/2014
01:00 PM
TK Keanini
TK Keanini
Commentary
Connect Directly
Facebook
Twitter
LinkedIn
RSS
E-Mail
50%
50%

If Mother Nature Were A CISO

There are many defensive patterns in nature that also apply to information security. Here's how to defeat your predators in the high-stakes game of corporate survival and resiliency.

People say the Internet is a hostile network (which is true), and that got me thinking about other hostile environments, where a successful strategy results in resiliency and continuity. What if Mother Nature were the CISO? What would her strategy be? What capabilities could she give the prey species, so they could survive in the presence of many predators?

To get a better understanding of the defensive tactics of prey species, it is worth spending a minute talking about the dominant strategies of predators. The three that I'll highlight are cruising, ambush, and the blend of these, which I'll call cruising-ambush. All of these offer similarities to the threat landscape we have been experiencing on the Internet.

  • Cruising: This is where the predator is continually on the move to locate prey. It's a pattern we can see reflected when the adversary broadly scans the Internet for targets. These targets are stationary in the sense that, once a target is found, a connection can be made repeatedly.
  • Ambush: Here the predator sits and waits. This strategy relies on the prey's mobility to initiate encounters. On the Internet today, we see this ambush pattern in a compromised web server sitting and waiting for prey to connect and pull down the exploits. The majority of malware is distributed in this ambush pattern.
  • Cruising-ambush: The blended cruising-ambush is by far the most effective predator pattern. The idea is to minimize exposure when cruising and employ effective ambush resources, which, in turn, cruise and create a loop in the pattern. A few threats exhibit this, such as a phishing campaign that broadly cruises for prey. Once the victim clicks on the phishing link, it quickly shifts to the ambush pattern, with a compromised web server sitting and waiting for the connection to download the malware.

Patterns of prey
There are many documented defensive patterns for prey species, and I'd like to explore the ones that can be applied to Internet security. In all of these cases, Mother Nature's common pattern is making the prey marginally too expensive for the predator to identify and/or pursue.

Certain prey species have raised the cost of observation and orientation so much that they are operating outside their predators' perceptive boundaries. Camouflage is one technique, and another is having parts of the organism be expendable, as in a gecko's tail or a few bees in the colony. Camouflaging can be accomplished in Internet security through cryptography or in the random addressing within a massively large space like IPv6. For the latter, where parts are expendable, one can imagine a front-end system where there are 100 servers behind an application delivery controller (ADC).

Another effective countermeasure to cruising found in nature is the dispersion of targets or the frequent changing of nonstationary targets. This raises the observation and orientation requirements of the predator. If the predator has to do more probing and searching in the reconnaissance phase, it becomes more easily detected.

The last prey species pattern I find useful is one of tolerance to loss. Some species have found a way to divert the predator to eat the non-essential parts and have an enhanced ability to recover rapidly from the damage. Likewise, subsystems should be able to fail, and this failure information be used as inputs to the system for recovery processes.

Species resilience
The game of survival and resiliency is at the level of species and not at the level of organism. Diversity, redundancy, and a high rate of change at the organism level provide stability at the species level. When we look at this pattern in information technology, we can quickly see the need for abstractions. For example, a web server farm of 10 servers (10 organisms) sits behind a load balancer that offers a service (the species).

Abstractions are available to us in our design of these systems, and we need to leverage them in the same way Mother Nature has over the past 3.8 billion years. Virtual servers, software-defined networking, virtual storage -- all the parts are at our disposal to design highly resilient species (services).

Prey species have found a way to establish a knowledge margin with their environment, and this is what we must do with our information systems. The systems you protect must continuously change based on two drivers: how long you think it will take your adversary to perform its reconnaissance and the detection of the adversary's presence. Each time your systems change, the cost for your adversary to infiltrate and, most importantly, to remain hidden is raised substantially, and this is the dominant strategy found in nature.

TK Keanini brings nearly 25 years of network and security experience to the CTO role. He is responsible for leading Lancope's evolution toward integrating security solutions with private and public cloud-based computing platforms. TK is also responsible for developing the ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
GonzSTL
100%
0%
GonzSTL,
User Rank: Ninja
4/8/2014 | 11:54:18 AM
Re: Great analogy and analysis
I like the analogy. Now if we only have a few million years to adapt to the predators' tactics, and an unlimited amount of species to sacrifice in the adaptation, plus unlimited funds to maintain pace or overcome those tactics, we should be in good shape ...
Marilyn Cohodas
100%
0%
Marilyn Cohodas,
User Rank: Strategist
4/7/2014 | 5:34:56 PM
Great analogy and analysis
Thanks for breaking down the threat landscape in such a vivid and imaginative way, TK! 
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3541
Published: 2014-07-29
The Repositories component in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to conduct PHP object injection attacks and execute arbitrary code via serialized data associated with an add-on.

CVE-2014-3542
Published: 2014-07-29
mod/lti/service.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via an XML external entity declaration in conjunction with an entity reference, related to an XML External Entity (XXE) is...

CVE-2014-3543
Published: 2014-07-29
mod/imscp/locallib.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote attackers to read arbitrary files via a package with a manifest file containing an XML external entity declaration in conjunction with an entity referenc...

CVE-2014-3544
Published: 2014-07-29
Cross-site scripting (XSS) vulnerability in user/profile.php in Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to inject arbitrary web script or HTML via the Skype ID profile field.

CVE-2014-3545
Published: 2014-07-29
Moodle through 2.3.11, 2.4.x before 2.4.11, 2.5.x before 2.5.7, 2.6.x before 2.6.4, and 2.7.x before 2.7.1 allows remote authenticated users to execute arbitrary code via a calculated question in a quiz.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Sara Peters hosts a conversation on Botnets and those who fight them.